{ "url": "https://www.fifa.com", "auditedAt": "2026-07-23T05:03:41.342Z", "mode": "report", "status": "completed", "statusDetail": "Coverage-complete model-driven audit of representative homepage, article, listing, search, error, and account-entry surfaces.", "page": { "appType": "spa", "framework": "React-like client-rendered SPA", "notes": "Public multilingual FIFA content portal. Core routes render from an empty #root shell; no local source was supplied." }, "evidenceUsed": [ "screenshot", "transition-video", "dom", "evaluate-probe", "layout-metrics", "performance-trace", "HAR", "discoverability/no-JS", "Lighthouse", "security-headers", "cookies", "trackers", "secrets-scan", "images-audit", "heap-summary", "HTTP/robots/sitemap" ], "guidanceConsulted": [ "dark-mode", "accessibility", "same-document-transitions", "scroll-position-aware-elements", "declarative-dialog-popover-control", "size-aware-styling", "forms", "persistent-toast-notifications", "performance", "break-up-long-tasks", "optimize-image-priority", "html", "security", "privacy", "flicker-free-client-side-ab-testing", "translator", "coordinate-global-events", "deliver-optimized-decorative-images", "efficient-background-processing", "webmcp", "language-model", "manage-recurring-intervals" ], "artifacts": [ { "type": "other", "path": "evidence/guidance/list.json", "caption": "guidance/list", "findingIds": [] }, { "type": "other", "path": "evidence/guidance/retrieved.md", "caption": "guidance/retrieved", "findingIds": [] }, { "type": "other", "path": "evidence/guidance/retrieved-extra.md", "caption": "guidance/retrieved extra", "findingIds": [] }, { "type": "other", "path": "evidence/home-comprehensive-probe.json", "caption": "home comprehensive probe", "findingIds": [ "F-01", "F-07", "F-16", "F-18", "F-33" ] }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "home dark", "condition": "prefers-color-scheme: dark", "findingIds": [ "F-01" ] }, { "type": "other", "path": "evidence/home-reduced-motion.json", "caption": "home reduced motion", "condition": "prefers-reduced-motion: reduce", "findingIds": [ "F-02" ] }, { "type": "screenshot", "path": "evidence/home-high-contrast.png", "caption": "home high contrast", "condition": "forced-colors: active / prefers-contrast: more", "findingIds": [] }, { "type": "video", "path": "evidence/search-transition.mp4", "caption": "search transition", "findingIds": [] }, { "type": "other", "path": "evidence/interaction-css-probe.json", "caption": "interaction css probe", "findingIds": [ "F-03" ] }, { "type": "other", "path": "evidence/search-probe.json", "caption": "search probe", "findingIds": [ "F-05" ] }, { "type": "screenshot", "path": "evidence/search-overlay.png", "caption": "search overlay", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "home desktop", "findingIds": [ "F-04", "F-06", "F-07", "F-24" ] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "home mobile", "condition": "viewport 360x800", "findingIds": [ "F-04" ] }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "home dom", "findingIds": [ "F-05" ] }, { "type": "layout", "path": "evidence/home-mobile-layout.json", "caption": "home mobile layout", "condition": "viewport 360x800", "findingIds": [ "F-10" ] }, { "type": "screenshot", "path": "evidence/article-mobile-clean.png", "caption": "article mobile clean", "condition": "viewport 360x800", "findingIds": [] }, { "type": "screenshot", "path": "evidence/category-mobile.png", "caption": "category mobile", "condition": "viewport 360x800", "findingIds": [] }, { "type": "other", "path": "evidence/mobile-focus-targets.json", "caption": "mobile focus targets", "condition": "viewport 360x800", "findingIds": [] }, { "type": "other", "path": "evidence/home-recon.json", "caption": "home recon", "findingIds": [] }, { "type": "screenshot", "path": "evidence/article-desktop.png", "caption": "article desktop", "findingIds": [] }, { "type": "other", "path": "evidence/not-found-probe.json", "caption": "not found probe", "findingIds": [ "F-08", "F-21", "F-29" ] }, { "type": "screenshot", "path": "evidence/not-found.png", "caption": "not found", "findingIds": [ "F-08", "F-29" ] }, { "type": "lighthouse", "path": "evidence/lighthouse-home-summary.json", "caption": "lighthouse home summary", "findingIds": [ "F-09", "F-11", "F-14", "F-15", "F-16", "F-17", "F-19", "F-20" ] }, { "type": "lighthouse", "path": "evidence/lighthouse-article-summary.json", "caption": "lighthouse article summary", "findingIds": [ "F-09", "F-10", "F-11", "F-14", "F-15", "F-17", "F-19", "F-20", "F-21" ] }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "home trace summary", "findingIds": [ "F-09", "F-11", "F-31" ] }, { "type": "other", "path": "evidence/home-summary.json", "caption": "home summary", "findingIds": [ "F-12", "F-13", "F-24", "F-30", "F-31", "F-32" ] }, { "type": "other", "path": "evidence/script-delivery-probe.json", "caption": "script delivery probe", "findingIds": [ "F-12" ] }, { "type": "har", "path": "evidence/home.har", "caption": "home", "findingIds": [ "F-12", "F-32" ] }, { "type": "other", "path": "evidence/home-images.json", "caption": "home images", "findingIds": [ "F-18", "F-30" ] }, { "type": "other", "path": "evidence/article-metadata-probe.json", "caption": "article metadata probe", "findingIds": [ "F-21", "F-22" ] }, { "type": "other", "path": "evidence/robots.txt", "caption": "robots", "findingIds": [ "F-20", "F-21" ] }, { "type": "other", "path": "evidence/sitemap-actual.xml", "caption": "sitemap actual", "findingIds": [ "F-21" ] }, { "type": "other", "path": "evidence/home-headers.json", "caption": "home headers", "findingIds": [ "F-23", "F-26" ] }, { "type": "other", "path": "evidence/home-cookies.json", "caption": "home cookies", "findingIds": [ "F-23" ] }, { "type": "other", "path": "evidence/home-trackers.json", "caption": "home trackers", "findingIds": [ "F-24" ] }, { "type": "other", "path": "evidence/pwa-permissions-probe.json", "caption": "pwa permissions probe", "findingIds": [ "F-25", "F-28" ] }, { "type": "other", "path": "evidence/auth-probe.json", "caption": "auth probe", "findingIds": [ "F-25" ] }, { "type": "screenshot", "path": "evidence/auth.png", "caption": "auth", "findingIds": [ "F-25" ] }, { "type": "discoverability", "path": "evidence/home-discoverability.json", "caption": "home discoverability", "findingIds": [ "F-27", "F-33" ] }, { "type": "screenshot", "path": "evidence/home-discoverability-crawler.png", "caption": "home discoverability crawler", "findingIds": [ "F-27" ] }, { "type": "discoverability", "path": "evidence/article-discoverability.json", "caption": "article discoverability", "findingIds": [ "F-27", "F-33" ] }, { "type": "screenshot", "path": "evidence/article-discoverability-crawler.png", "caption": "article discoverability crawler", "findingIds": [ "F-27" ] }, { "type": "discoverability", "path": "evidence/category-discoverability.json", "caption": "category discoverability", "findingIds": [ "F-27" ] }, { "type": "screenshot", "path": "evidence/category-discoverability-crawler.png", "caption": "category discoverability crawler", "findingIds": [ "F-27" ] }, { "type": "heap", "path": "evidence/heap-baseline.json", "caption": "heap baseline", "findingIds": [ "F-34" ] }, { "type": "heap", "path": "evidence/heap-post-search.json", "caption": "heap post search", "findingIds": [] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "evaluate computed styles plus dark-media screenshot", "evidence": "Computed-style probe reports color-scheme: normal, and the dark-emulated capture retains the same hard-coded palette rather than declaring a user-preference-driven scheme.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-comprehensive-probe.json", "evidence/home-dark.png" ], "findingIds": [ "F-01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "issues", "confidence": "high", "method": "evaluate under emulated reduced motion", "evidence": "Under prefers-reduced-motion: reduce, the page still runs a 10.5 s hero animation and more than 100 repeating 1 s skeleton animations; the probe found zero reduced-motion CSS rules.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-reduced-motion.json" ], "findingIds": [ "F-02" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "pass", "confidence": "medium", "method": "forced-colors screenshot", "evidence": "The forced-colors/prefers-contrast capture preserves visible text, controls, outlines, and consent actions.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-high-contrast.png" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "pass", "confidence": "medium", "method": "computed-style probe and transition video", "evidence": "Computed styles expose view-transition-name: root and the recorded search route change provides direct transition evidence.", "pathIds": [ "search" ], "artifacts": [ "evidence/home-comprehensive-probe.json", "evidence/search-transition.mp4" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "pass", "confidence": "medium", "method": "CSSOM inspection", "evidence": "DOM/CSS inspection found no scroll-timeline rules and the reviewed pages did not present parallax or scrollytelling that would require a scroll-linked implementation.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-comprehensive-probe.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "issues", "confidence": "medium", "method": "computed-style gesture probe", "evidence": "The homepage contains carousel-style content but computed-style inspection found no scroll-snap or overscroll treatment on any element, so gesture behavior is not platform-native.", "pathIds": [ "home" ], "artifacts": [ "evidence/interaction-css-probe.json" ], "findingIds": [ "F-03" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "pass", "confidence": "medium", "method": "computed-style probe", "evidence": "Computed styles identify the primary header as position: sticky at top: 0, keeping navigation available as content scrolls.", "pathIds": [ "home" ], "artifacts": [ "evidence/interaction-css-probe.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "not-applicable", "confidence": "medium", "method": "DOM overlay inventory", "evidence": "The representative pages exposed full-screen search/consent dialogs but no tooltip or edge-attached popover whose position needed CSS anchor positioning.", "pathIds": [ "search" ], "artifacts": [ "evidence/search-probe.json" ], "reason": "The representative pages exposed full-screen search/consent dialogs but no tooltip or edge-attached popover whose position needed CSS anchor positioning." }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "high", "method": "active-element probe and screenshot", "evidence": "Opening the search route moves focus directly to the search input, and the overlay visibly separates the active task from the underlying page.", "pathIds": [ "search" ], "artifacts": [ "evidence/search-probe.json", "evidence/search-overlay.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "issues", "confidence": "high", "method": "desktop and mobile screenshots", "evidence": "The first viewport is simultaneously obscured by a centered Play Zone promotion and a large consent wall; on mobile the consent wall occupies essentially the entire viewport.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png" ], "findingIds": [ "F-04" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "issues", "confidence": "high", "method": "DOM dialog inventory", "evidence": "The consent and privacy overlays are DIV elements with role=dialog; the primary banner lacks aria-modal and the search overlay is custom rather than a native dialog/popover.", "pathIds": [ "search" ], "artifacts": [ "evidence/search-probe.json", "evidence/home-dom.json" ], "findingIds": [ "F-05" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "issues", "confidence": "high", "method": "first-viewport screenshot", "evidence": "Two stacked overlays plus two navigation bars leave the actual football content dimmed and largely unavailable in the initial viewport.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png" ], "findingIds": [ "F-06" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "high", "method": "mobile layout metrics", "evidence": "At 360x800 the layout primitive reports scrollWidth=clientWidth=360, zero horizontal overflow, and a viewport meta tag.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile-layout.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "pass", "confidence": "medium", "method": "CSSOM and mobile captures", "evidence": "CSSOM inspection found 16 container rules, and the tested homepage/article/category surfaces reflowed to the 360 px viewport without overflow.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-comprehensive-probe.json", "evidence/article-mobile-clean.png", "evidence/category-mobile.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "pass", "confidence": "medium", "method": "focus and target-size probe", "evidence": "Keyboard focus probes show visible outlines on navigation, search, account, consent, and menu controls; the mobile target inventory found only two text controls below 24 px high.", "pathIds": [ "home" ], "artifacts": [ "evidence/mobile-focus-targets.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "issues", "confidence": "high", "method": "heading probe and screenshot", "evidence": "The homepage H1 and dominant action describe Play Zone rather than the FIFA news/content destination, while promotional and consent overlays compete for the first action.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-comprehensive-probe.json", "evidence/home-desktop.png" ], "findingIds": [ "F-07" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "medium", "method": "route walkthrough and screenshots", "evidence": "The representative discovery flow completes from homepage links to a fully rendered article, and the search route opens with focus in the query field.", "pathIds": [ "article" ], "artifacts": [ "evidence/home-recon.json", "evidence/article-desktop.png", "evidence/search-probe.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "issues", "confidence": "high", "method": "HTTP probe, DOM probe, and screenshot", "evidence": "A nonexistent route returns HTTP 200, has an empty title, and shows only a joke message with no home, search, back, or retry link.", "pathIds": [ "error" ], "artifacts": [ "evidence/not-found-probe.json", "evidence/not-found.png" ], "findingIds": [ "F-08" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Lighthouse plus performance trace", "evidence": "Lighthouse measured homepage LCP 29.3 s and TBT 1,860 ms; the article measured LCP 33.8 s, TBT 1,990 ms, and CLS 1.108. A separate trace measured LCP 5.84 s.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home-summary.json", "evidence/lighthouse-article-summary.json", "evidence/home-trace-summary.json" ], "findingIds": [ "F-09" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "issues", "confidence": "high", "method": "Lighthouse and layout-shift observer", "evidence": "The article Lighthouse run measured CLS 1.108, and the mobile layout observer recorded CLS 1.35 with two approximately 0.61 shifts after load.", "pathIds": [ "article" ], "artifacts": [ "evidence/lighthouse-article-summary.json", "evidence/home-mobile-layout.json" ], "findingIds": [ "F-10" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "issues", "confidence": "high", "method": "trace and Lighthouse", "evidence": "The trace recorded four long tasks, a 355 ms longest task, and 375 ms total blocking time; Lighthouse measured 1.86-1.99 s TBT.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-trace-summary.json", "evidence/lighthouse-home-summary.json", "evidence/lighthouse-article-summary.json" ], "findingIds": [ "F-11" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "HAR summary plus script attribute probe", "evidence": "The HAR records 6.0 MB over 87 requests, 4.07 MB of script, eight fonts, missing cache headers on a 1.77 MB auth SDK, and multiple synchronous parser-inserted head scripts confirmed by DOM inspection.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/script-delivery-probe.json", "evidence/home.har" ], "findingIds": [ "F-12" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "HAR weight-offender analysis", "evidence": "The homepage ships 35 scripts totaling 4.07 MB; a 1.77 MB PingOne SDK, 783 KB consent blocker, 325 KB PDF worker, and other integrations load before the user requests those capabilities.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json" ], "findingIds": [ "F-13" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "medium", "method": "Lighthouse accessibility audits", "evidence": "Lighthouse found aria-prohibited-attr and label-content-name-mismatch on the homepage and an unnamed button on the article.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home-summary.json", "evidence/lighthouse-article-summary.json" ], "findingIds": [ "F-14" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "issues", "confidence": "medium", "method": "Lighthouse contrast audits", "evidence": "Lighthouse color-contrast audits fail on both the homepage and article despite forced-colors remaining usable.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home-summary.json", "evidence/lighthouse-article-summary.json" ], "findingIds": [ "F-15" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "medium", "method": "Lighthouse and heading inventory", "evidence": "Lighthouse reports heading-order failure on the homepage; the DOM starts at H1 then repeated H3 cards and injects extensive consent-dialog headings into document structure.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home-summary.json", "evidence/home-comprehensive-probe.json" ], "findingIds": [ "F-16" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "medium", "method": "desktop and mobile visual review", "evidence": "Article screenshots show readable line length, clear hierarchy, and no clipped body text at desktop and mobile widths.", "pathIds": [ "article" ], "artifacts": [ "evidence/article-desktop.png", "evidence/article-mobile-clean.png" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "pass", "confidence": "medium", "method": "viewport, layout, and target probes", "evidence": "Viewport content allows scaling, 360 px layouts have no horizontal overflow, focus remains visible, and the target probe found the primary controls appropriately sized.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-comprehensive-probe.json", "evidence/home-mobile-layout.json", "evidence/mobile-focus-targets.json" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "issues", "confidence": "medium", "method": "Lighthouse best-practices audits", "evidence": "Lighthouse reports errors-in-console on both the homepage and article.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home-summary.json", "evidence/lighthouse-article-summary.json" ], "findingIds": [ "F-17" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "low", "method": "DOM and image audit", "evidence": "The document has valid HTML doctype/UTF-8, but the image audit found two images without intrinsic dimensions and one asset rendered from a source more than 15x wider than display size.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-comprehensive-probe.json", "evidence/home-images.json" ], "findingIds": [ "F-18" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "issues", "confidence": "medium", "method": "Lighthouse platform audits", "evidence": "Lighthouse reports invalid source maps on both templates and a BFCache failure on the homepage.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home-summary.json", "evidence/lighthouse-article-summary.json" ], "findingIds": [ "F-19" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "pass", "confidence": "high", "method": "rendered metadata probes", "evidence": "Rendered homepage and article each have descriptive, route-specific titles and meta descriptions.", "pathIds": [ "article" ], "artifacts": [ "evidence/home-comprehensive-probe.json", "evidence/article-metadata-probe.json" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "issues", "confidence": "high", "method": "Lighthouse SEO plus robots", "evidence": "Lighthouse reports non-descriptive link text on both pages and non-crawlable anchors on the article, even though viewport and robots basics are present.", "pathIds": [ "article" ], "artifacts": [ "evidence/lighthouse-home-summary.json", "evidence/lighthouse-article-summary.json", "evidence/robots.txt" ], "findingIds": [ "F-20" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "issues", "confidence": "high", "method": "metadata, Lighthouse, robots/sitemap, and HTTP probes", "evidence": "The article exposes no canonical link, its og:url incorrectly points to /fifaplus, Lighthouse flags hreflang, and nonexistent routes return HTTP 200.", "pathIds": [ "article" ], "artifacts": [ "evidence/article-metadata-probe.json", "evidence/lighthouse-article-summary.json", "evidence/robots.txt", "evidence/sitemap-actual.xml", "evidence/not-found-probe.json" ], "findingIds": [ "F-21" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "issues", "confidence": "medium", "method": "article metadata probe", "evidence": "The news article has no JSON-LD structured data and its Open Graph URL is https://www.fifa.com/fifaplus rather than the visible article URL.", "pathIds": [ "article" ], "artifacts": [ "evidence/article-metadata-probe.json" ], "findingIds": [ "F-22" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "headers and cookie audits", "evidence": "HTTPS, HSTS and nosniff are present, but CSP allows unsafe-inline and unsafe-eval and the bm_sz cookie is not Secure with SameSite=None.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-headers.json", "evidence/home-cookies.json" ], "findingIds": [ "F-23" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "consent screenshot, HAR, and tracker audit", "evidence": "The consent wall names 1,017 partners; the HAR records 47 third-party requests transferring 4.11 MB and the tracker inventory finds 12 third-party origins.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-summary.json", "evidence/home-trackers.json" ], "findingIds": [ "F-24" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "issues", "confidence": "medium", "method": "permissions and auth probes", "evidence": "Notification/geolocation remain prompt rather than being requested on load, but the account/auth surface exposed no passkey or WebAuthn flow and the inspected /auth route produced an empty-title dead end.", "pathIds": [ "auth" ], "artifacts": [ "evidence/pwa-permissions-probe.json", "evidence/auth-probe.json", "evidence/auth.png" ], "findingIds": [ "F-25" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "medium", "method": "security-header audit", "evidence": "HSTS, SAMEORIGIN, no-referrer and nosniff are configured, but Permissions-Policy is missing and the CSP relies on unsafe-inline/unsafe-eval with an exceptionally broad allowlist.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-headers.json" ], "findingIds": [ "F-26" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "issues", "confidence": "high", "method": "discoverability no-JS comparison", "evidence": "Raw HTML for homepage, category and article is an empty #root shell: 0% rendered content coverage, no raw title/H1/description, and blank crawler screenshots without JavaScript.", "pathIds": [ "article" ], "artifacts": [ "evidence/home-discoverability.json", "evidence/home-discoverability-crawler.png", "evidence/article-discoverability.json", "evidence/article-discoverability-crawler.png", "evidence/category-discoverability.json", "evidence/category-discoverability-crawler.png" ], "findingIds": [ "F-27" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "medium", "method": "overlay DOM and screenshots", "evidence": "Search remains focused and usable as a full-width overlay, while inspected sticky navigation stays within the viewport and no clipped edge menus appeared on tested paths.", "pathIds": [ "search" ], "artifacts": [ "evidence/search-probe.json", "evidence/search-overlay.png", "evidence/interaction-css-probe.json" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "issues", "confidence": "low", "method": "manifest and service-worker probe", "evidence": "A standalone web app manifest exists, but navigator.serviceWorker.getRegistrations() returned no registrations, so no offline fallback is active.", "pathIds": [ "home" ], "artifacts": [ "evidence/pwa-permissions-probe.json" ], "findingIds": [ "F-28" ] }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "issues", "confidence": "high", "method": "HTTP/DOM failure-state walkthrough", "evidence": "The tested missing route returns a soft-404 HTTP 200 and offers no actionable recovery control, title, or link.", "pathIds": [ "error" ], "artifacts": [ "evidence/not-found-probe.json", "evidence/not-found.png" ], "findingIds": [ "F-29" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "pass", "confidence": "medium", "method": "DOM metadata probes", "evidence": "The page declares lang=en and dir=ltr and exposes ten localized hreflang variants; alternate-language URLs are present for the article.", "pathIds": [ "article" ], "artifacts": [ "evidence/home-comprehensive-probe.json", "evidence/article-metadata-probe.json" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "pass", "confidence": "medium", "method": "article content and locale metadata", "evidence": "The article renders a localized human-readable publication date and supplies distinct language-specific article URLs for ten locales.", "pathIds": [ "article" ], "artifacts": [ "evidence/article-metadata-probe.json" ] }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "medium", "method": "content inventory", "evidence": "The representative news, listing, search, and error surfaces exposed no event times, scheduling, recurrence, or cross-time-zone interaction to evaluate.", "pathIds": [ "article" ], "artifacts": [ "evidence/article-metadata-probe.json" ], "reason": "The representative news, listing, search, and error surfaces exposed no event times, scheduling, recurrence, or cross-time-zone interaction to evaluate." }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "medium", "method": "consent visual review", "evidence": "The consent wall presents I Accept and Reject All as equally prominent controls and states the consequences of each choice; no preselected purchase or forced-continuity flow was observed.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "not-applicable", "confidence": "medium", "method": "form inventory", "evidence": "The exercised first-party surfaces contained search but no required-input form or validation flow; article, listing, and search navigation did not solicit error-prone user data.", "pathIds": [ "search" ], "artifacts": [ "evidence/home-comprehensive-probe.json", "evidence/search-probe.json" ], "reason": "The exercised first-party surfaces contained search but no required-input form or validation flow; article, listing, and search navigation did not solicit error-prone user data." }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "not-applicable", "confidence": "medium", "method": "input inventory", "evidence": "The only first-party text input exercised was site search, which does not require address, payment, sign-in, or sign-up autofill tokens.", "pathIds": [ "search" ], "artifacts": [ "evidence/search-probe.json" ], "reason": "The only first-party text input exercised was site search, which does not require address, payment, sign-in, or sign-up autofill tokens." }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "not-applicable", "confidence": "medium", "method": "navigation and auth surface inventory", "evidence": "Store, ticketing, rewards and Play Zone are separate linked products; no checkout, subscription, cancellation, or account-management flow was available within the audited fifa.com templates.", "pathIds": [ "auth" ], "artifacts": [ "evidence/home-recon.json", "evidence/auth-probe.json" ], "reason": "Store, ticketing, rewards and Play Zone are separate linked products; no checkout, subscription, cancellation, or account-management flow was available within the audited fifa.com templates." }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "medium", "method": "HAR and image audit", "evidence": "The page transfers 437 KB of images and the image audit finds an oversized logo source (1178 px natural width for 74 px display) plus a legacy PNG.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/home-images.json" ], "findingIds": [ "F-30" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "issues", "confidence": "high", "method": "HAR and trace analysis", "evidence": "The initial load fetches a PDF worker, a 1.77 MB auth SDK, consent/analytics integrations, and 35 scripts before those capabilities are requested, while trace/Lighthouse show substantial blocking work.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/home-trace-summary.json" ], "findingIds": [ "F-31" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "HAR third-party budget", "evidence": "Third parties account for 47 requests and 4.11 MB, about 69% of transferred bytes; PingOne and OneTrust alone transfer roughly 2.87 MB.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/home.har" ], "findingIds": [ "F-32" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "issues", "confidence": "low", "method": "agent-capability and discoverability probes", "evidence": "This globally prominent content site exposes no WebMCP/agentic form capability, while non-JavaScript agents receive an empty shell with 0% content coverage.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-comprehensive-probe.json", "evidence/home-discoverability.json", "evidence/article-discoverability.json" ], "findingIds": [ "F-33" ] }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "medium", "method": "feature inventory", "evidence": "The audited content, listing, search, and navigation tasks do not require on-device generation or summarisation; no user-facing inference feature was present.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-comprehensive-probe.json" ], "reason": "The audited content, listing, search, and navigation tasks do not require on-device generation or summarisation; no user-facing inference feature was present." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "medium", "method": "baseline/post heap summaries", "evidence": "After ten repeated search-input updates, retained snapshot totals decreased slightly: nodes 1,491,962 to 1,491,952 and self size 80,838,979 to 80,804,689 bytes.", "pathIds": [ "search" ], "artifacts": [ "evidence/heap-baseline.json", "evidence/heap-post-search.json" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "issues", "confidence": "medium", "method": "heap summary", "evidence": "A single homepage/search state retains about 80.8 MB across 1.49 million heap nodes, a large footprint for a content/search page before extended use.", "pathIds": [ "search" ], "artifacts": [ "evidence/heap-baseline.json" ], "findingIds": [ "F-34" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "medium", "method": "comparative heap summaries", "evidence": "The repeated-interaction snapshot did not grow overall nodes, edges, closures, Objects, or Arrays, and no Detached constructor appeared among size-leading constructors.", "pathIds": [ "search" ], "artifacts": [ "evidence/heap-baseline.json", "evidence/heap-post-search.json" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F-01", "F-02" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F-03" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "pass" }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F-04", "F-05", "F-06" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "pass" }, { "principleId": "support-core-task-success", "expectation": "default", "status": "issues", "findingIds": [ "F-07", "F-08" ] }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F-09", "F-10", "F-11", "F-12", "F-13" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F-14", "F-15", "F-16" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F-17", "F-18", "F-19" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F-20", "F-21", "F-22" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F-23", "F-24", "F-25", "F-26" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F-27", "F-28", "F-29" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "pass" }, { "principleId": "be-trustworthy", "expectation": "default", "status": "pass" }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F-30", "F-31", "F-32" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "issues", "findingIds": [ "F-33" ] }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "issues", "findingIds": [ "F-34" ] } ], "paths": [ { "id": "home", "description": "Homepage and global navigation, representative landing/content-discovery template; tested desktop, mobile, dark, reduced-motion, high-contrast, performance, privacy, security, network, and memory conditions.", "url": "https://www.fifa.com/en", "conditions": [ "1440x1000", "360x800", "prefers-color-scheme: dark", "prefers-reduced-motion: reduce", "forced-colors: active" ], "result": "issues" }, { "id": "article", "description": "Current World Cup awards article, representative long-form editorial/detail template and primary homepage destination.", "url": "https://www.fifa.com/en/articles/award-winners", "conditions": [ "1440x1000", "360x800", "JavaScript disabled crawler comparison" ], "result": "issues" }, { "id": "category", "description": "Top stories category, representative listing/index template.", "url": "https://www.fifa.com/en/cat/5TSUVautxNVjLKkYs8bCON", "conditions": [ "360x800", "JavaScript disabled crawler comparison" ], "result": "issues" }, { "id": "search", "description": "Search overlay and repeated-query interaction, representative first-party interactive flow.", "url": "https://www.fifa.com/en?searchOverlay=1", "conditions": [ "keyboard focus", "10 repeated input updates", "heap baseline/post" ], "result": "issues" }, { "id": "error", "description": "Nonexistent content route, representative HTTP/runtime failure and recovery state.", "url": "https://www.fifa.com/en/this-route-does-not-exist-atomic-audit", "conditions": [ "desktop", "HTTP status" ], "result": "issues" }, { "id": "auth", "description": "Account-entry/auth route reached from the global account affordance, used to inspect permission/auth posture.", "url": "https://www.fifa.com/en/auth", "conditions": [ "desktop" ], "result": "issues" } ], "findings": [ { "id": "F-01", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "severity": "medium", "confidence": "high", "summary": "Honours prefers-color-scheme: a usable dark mode exists and is driven by the user's preference (color-scheme / prefers-color-scheme / light-dark()), not hard-coded light only.", "evidence": "Computed-style probe reports color-scheme: normal, and the dark-emulated capture retains the same hard-coded palette rather than declaring a user-preference-driven scheme.", "artifacts": [ "evidence/home-comprehensive-probe.json", "evidence/home-dark.png" ], "suggestedFix": "Declare color-scheme: light dark and map surfaces/text to preference-aware tokens such as light-dark().", "effort": "medium" }, { "id": "F-02", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "respect-user-preferences", "principleCheckId": "respects-reduced-motion", "guidanceId": "accessibility", "severity": "high", "confidence": "high", "summary": "Honours prefers-reduced-motion: non-essential animations and auto-advance are reduced or removed when the user asks for less motion.", "evidence": "Under prefers-reduced-motion: reduce, the page still runs a 10.5 s hero animation and more than 100 repeating 1 s skeleton animations; the probe found zero reduced-motion CSS rules.", "artifacts": [ "evidence/home-reduced-motion.json" ], "suggestedFix": "Add a prefers-reduced-motion: reduce branch that disables auto-advance and non-essential hero/skeleton animation.", "effort": "small" }, { "id": "F-03", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "implement-natural-interactions", "principleCheckId": "physical-gestures", "guidanceId": "css-layout", "severity": "medium", "confidence": "medium", "summary": "Gesture-driven interactions and entry/exit motion feel native (declarative overscroll/scroll-snap, physics-based easing, animating to intrinsic sizes, pull/swipe gestures) rather than fighting the platform with custom pointer handlers.", "evidence": "The homepage contains carousel-style content but computed-style inspection found no scroll-snap or overscroll treatment on any element, so gesture behavior is not platform-native.", "artifacts": [ "evidence/interaction-css-probe.json" ], "suggestedFix": "Use native overflow with scroll-snap-type/scroll-snap-align and appropriate overscroll behavior for swipeable rails.", "effort": "medium" }, { "id": "F-04", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "maximize-content-reduce-noise", "principleCheckId": "no-intrusive-interruptions", "guidanceId": "light-dismiss-a-dialog", "severity": "high", "confidence": "high", "summary": "No intrusive pop-ups, interstitials or banners that obscure content on load; overlays are dismissible and content-first.", "evidence": "The first viewport is simultaneously obscured by a centered Play Zone promotion and a large consent wall; on mobile the consent wall occupies essentially the entire viewport.", "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png" ], "suggestedFix": "Do not stack promotional and consent overlays; defer the Play Zone promotion and keep core content available.", "effort": "medium" }, { "id": "F-05", "pathId": "search", "url": "https://www.fifa.com/en?searchOverlay=1", "principleId": "maximize-content-reduce-noise", "principleCheckId": "semantic-dismissible-primitives", "guidanceId": "declarative-dialog-popover-control", "severity": "medium", "confidence": "high", "summary": "Overlays and rich controls use the right primitive: popover (with declarative light-dismiss) for transient UI, dialog for modal flows, details for disclosure, native-but-branded selects and pickers, rather than ad-hoc divs.", "evidence": "The consent and privacy overlays are DIV elements with role=dialog; the primary banner lacks aria-modal and the search overlay is custom rather than a native dialog/popover.", "artifacts": [ "evidence/search-probe.json", "evidence/home-dom.json" ], "suggestedFix": "Implement modal flows with and transient UI with popover, including native focus and light-dismiss behavior.", "effort": "medium" }, { "id": "F-06", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "maximize-content-reduce-noise", "principleCheckId": "reduced-chrome", "guidanceId": "accessibility", "severity": "medium", "confidence": "high", "summary": "Minimise non-content chrome and borders so the content is the focus, not the application frame; expressive/decorative visuals serve the content rather than crowd it.", "evidence": "Two stacked overlays plus two navigation bars leave the actual football content dimmed and largely unavailable in the initial viewport.", "artifacts": [ "evidence/home-desktop.png" ], "suggestedFix": "Remove competing initial chrome and reserve the first viewport for the page purpose and primary content.", "effort": "medium" }, { "id": "F-07", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "support-core-task-success", "principleCheckId": "clear-purpose-and-primary-action", "guidanceId": "scrollability-affordance-hints", "severity": "high", "confidence": "high", "summary": "The page communicates what it is for and exposes the primary next action without requiring users to hunt through decorative content, generic copy, or competing calls to action.", "evidence": "The homepage H1 and dominant action describe Play Zone rather than the FIFA news/content destination, while promotional and consent overlays compete for the first action.", "artifacts": [ "evidence/home-comprehensive-probe.json", "evidence/home-desktop.png" ], "suggestedFix": "Restore a content-oriented H1 and one clear next action; present Play Zone as optional secondary promotion.", "effort": "medium" }, { "id": "F-08", "pathId": "error", "url": "https://www.fifa.com/en/this-route-does-not-exist-atomic-audit", "principleId": "support-core-task-success", "principleCheckId": "clear-system-state-and-recovery", "guidanceId": "persistent-toast-notifications", "severity": "high", "confidence": "high", "summary": "Loading, empty, success, error, offline, and partial-completion states are visible and actionable; users can retry, undo, cancel, go back, or continue without losing context.", "evidence": "A nonexistent route returns HTTP 200, has an empty title, and shows only a joke message with no home, search, back, or retry link.", "artifacts": [ "evidence/not-found-probe.json", "evidence/not-found.png" ], "suggestedFix": "Return a real 404 and provide clear Home, Search, and Back recovery actions with a descriptive title.", "effort": "small" }, { "id": "F-09", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "severity": "critical", "confidence": "high", "summary": "Core Web Vitals are in the good range: LCP is fast, interaction latency (INP) is low, and CLS is minimal; work is prioritised and deferred sensibly.", "evidence": "Lighthouse measured homepage LCP 29.3 s and TBT 1,860 ms; the article measured LCP 33.8 s, TBT 1,990 ms, and CLS 1.108. A separate trace measured LCP 5.84 s.", "artifacts": [ "evidence/lighthouse-home-summary.json", "evidence/lighthouse-article-summary.json", "evidence/home-trace-summary.json" ], "suggestedFix": "Set a performance budget and prioritize the LCP path; defer non-critical integrations until after content and interaction readiness.", "effort": "large" }, { "id": "F-10", "pathId": "article", "url": "https://www.fifa.com/en/articles/award-winners", "principleId": "be-fast-and-stable", "principleCheckId": "visual-stability", "guidanceId": "visually-stable-font-fallbacks", "severity": "high", "confidence": "high", "summary": "No cumulative layout shift from late content (images, banners, fonts) that arrives without reserved space.", "evidence": "The article Lighthouse run measured CLS 1.108, and the mobile layout observer recorded CLS 1.35 with two approximately 0.61 shifts after load.", "artifacts": [ "evidence/lighthouse-article-summary.json", "evidence/home-mobile-layout.json" ], "suggestedFix": "Reserve space for late sections/media and make overlays or dynamic content enter without moving existing content.", "effort": "medium" }, { "id": "F-11", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-main-thread", "guidanceId": "break-up-long-tasks", "severity": "high", "confidence": "high", "summary": "The main thread is not blocked by long tasks or heavy scripting; work is deferred, chunked, prioritised, or moved off-thread.", "evidence": "The trace recorded four long tasks, a 355 ms longest task, and 375 ms total blocking time; Lighthouse measured 1.86-1.99 s TBT.", "artifacts": [ "evidence/home-trace-summary.json", "evidence/lighthouse-home-summary.json", "evidence/lighthouse-article-summary.json" ], "suggestedFix": "Break up startup tasks, defer optional SDK initialization, and schedule non-critical work after the page becomes interactive.", "effort": "large" }, { "id": "F-12", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-script-priority", "severity": "high", "confidence": "high", "summary": "Critical resources are delivered efficiently: cache headers are useful, render-blocking chains are short, fonts do not block or shift text, HTTP delivery is modern, and network dependency trees do not delay the main content.", "evidence": "The HAR records 6.0 MB over 87 requests, 4.07 MB of script, eight fonts, missing cache headers on a 1.77 MB auth SDK, and multiple synchronous parser-inserted head scripts confirmed by DOM inspection.", "artifacts": [ "evidence/home-summary.json", "evidence/script-delivery-probe.json", "evidence/home.har" ], "suggestedFix": "Make non-critical scripts async/deferred or interaction-triggered, trim preloads, and add durable cache headers.", "effort": "large" }, { "id": "F-13", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "severity": "high", "confidence": "high", "summary": "The page does not ship large unused or duplicated JavaScript/CSS, avoidable legacy bundles, or third-party code that dominates the load without user value.", "evidence": "The homepage ships 35 scripts totaling 4.07 MB; a 1.77 MB PingOne SDK, 783 KB consent blocker, 325 KB PDF worker, and other integrations load before the user requests those capabilities.", "artifacts": [ "evidence/home-summary.json" ], "suggestedFix": "Load auth, PDF, video, consent extensions, and analytics only on routes or interactions that need them.", "effort": "large" }, { "id": "F-14", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "severity": "medium", "confidence": "medium", "summary": "Interactive elements have accessible names, correct roles, and form fields have labels; images have alt text where meaningful; canvas/expressive content is exposed to assistive technology.", "evidence": "Lighthouse found aria-prohibited-attr and label-content-name-mismatch on the homepage and an unnamed button on the article.", "artifacts": [ "evidence/lighthouse-home-summary.json", "evidence/lighthouse-article-summary.json" ], "suggestedFix": "Fix Lighthouse ARIA/name failures and give every icon button a stable accessible name matching its visible label.", "effort": "small" }, { "id": "F-15", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "be-inclusive", "principleCheckId": "sufficient-contrast", "guidanceId": "accessibility", "severity": "medium", "confidence": "medium", "summary": "Text and essential UI meet WCAG colour-contrast minimums against their background.", "evidence": "Lighthouse color-contrast audits fail on both the homepage and article despite forced-colors remaining usable.", "artifacts": [ "evidence/lighthouse-home-summary.json", "evidence/lighthouse-article-summary.json" ], "suggestedFix": "Adjust failing foreground/background token pairs to meet WCAG AA in normal rendering.", "effort": "small" }, { "id": "F-16", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "severity": "medium", "confidence": "medium", "summary": "Heading and landmark structure is logical, focus order follows reading order, keyboard focus is always visible, and interactive state survives DOM moves.", "evidence": "Lighthouse reports heading-order failure on the homepage; the DOM starts at H1 then repeated H3 cards and injects extensive consent-dialog headings into document structure.", "artifacts": [ "evidence/lighthouse-home-summary.json", "evidence/home-comprehensive-probe.json" ], "suggestedFix": "Use a sequential heading hierarchy and isolate consent-dialog headings from the underlying page structure.", "effort": "small" }, { "id": "F-17", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "follow-best-practices", "principleCheckId": "no-console-errors", "guidanceId": "html", "severity": "medium", "confidence": "medium", "summary": "The page loads without console errors or uncaught exceptions.", "evidence": "Lighthouse reports errors-in-console on both the homepage and article.", "artifacts": [ "evidence/lighthouse-home-summary.json", "evidence/lighthouse-article-summary.json" ], "suggestedFix": "Resolve runtime console exceptions on both templates and add smoke coverage that fails on uncaught errors.", "effort": "medium" }, { "id": "F-18", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "html", "severity": "low", "confidence": "low", "summary": "Valid doctype and charset, images sized with correct aspect ratio, no deprecated APIs misused, and CSS/HTML are well structured and not needlessly repetitive. (HTTPS, CSP and permission hygiene are judged under be-private-and-secure, not here.)", "evidence": "The document has valid HTML doctype/UTF-8, but the image audit found two images without intrinsic dimensions and one asset rendered from a source more than 15x wider than display size.", "artifacts": [ "evidence/home-comprehensive-probe.json", "evidence/home-images.json" ], "suggestedFix": "Give all images intrinsic dimensions and serve the logo at an appropriate responsive size.", "effort": "small" }, { "id": "F-19", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "follow-best-practices", "principleCheckId": "browser-platform-hygiene", "guidanceId": "html", "severity": "low", "confidence": "medium", "summary": "The page uses the platform cleanly: no deprecated APIs, no avoidable BFCache blockers, no broken source maps or inspector issues, no stale vulnerable libraries, no paste-prevention on inputs, and no notification/geolocation prompts on load.", "evidence": "Lighthouse reports invalid source maps on both templates and a BFCache failure on the homepage.", "artifacts": [ "evidence/lighthouse-home-summary.json", "evidence/lighthouse-article-summary.json" ], "suggestedFix": "Publish valid source maps for production diagnostics and remove the reported BFCache blockers.", "effort": "medium" }, { "id": "F-20", "pathId": "article", "url": "https://www.fifa.com/en/articles/award-winners", "principleId": "be-discoverable", "principleCheckId": "crawlable-and-mobile-friendly", "guidanceId": "html", "severity": "medium", "confidence": "high", "summary": "Links are crawlable (real href), there is a viewport meta tag, robots does not block indexing, and link text is descriptive.", "evidence": "Lighthouse reports non-descriptive link text on both pages and non-crawlable anchors on the article, even though viewport and robots basics are present.", "artifacts": [ "evidence/lighthouse-home-summary.json", "evidence/lighthouse-article-summary.json", "evidence/robots.txt" ], "suggestedFix": "Use descriptive link text and real href anchors for every navigational destination.", "effort": "small" }, { "id": "F-21", "pathId": "article", "url": "https://www.fifa.com/en/articles/award-winners", "principleId": "be-discoverable", "principleCheckId": "canonical-and-indexing-signals", "guidanceId": "html", "severity": "high", "confidence": "high", "summary": "Public pages expose the indexing signals search engines need: successful HTTP status, canonical URL when appropriate, hreflang for localized variants, robots/sitemap consistency, and no accidental noindex/noarchive policy.", "evidence": "The article exposes no canonical link, its og:url incorrectly points to /fifaplus, Lighthouse flags hreflang, and nonexistent routes return HTTP 200.", "artifacts": [ "evidence/article-metadata-probe.json", "evidence/lighthouse-article-summary.json", "evidence/robots.txt", "evidence/sitemap-actual.xml", "evidence/not-found-probe.json" ], "suggestedFix": "Emit correct per-route canonical/hreflang signals and real HTTP 404 status for missing routes.", "effort": "medium" }, { "id": "F-22", "pathId": "article", "url": "https://www.fifa.com/en/articles/award-winners", "principleId": "be-discoverable", "principleCheckId": "structured-and-shareable-metadata", "guidanceId": "html", "severity": "medium", "confidence": "medium", "summary": "Where the page represents an article, product, organization, event, place or other rich entity, structured data and share-preview metadata accurately describe the visible content.", "evidence": "The news article has no JSON-LD structured data and its Open Graph URL is https://www.fifa.com/fifaplus rather than the visible article URL.", "artifacts": [ "evidence/article-metadata-probe.json" ], "suggestedFix": "Add NewsArticle JSON-LD and set og:url to the canonical article URL.", "effort": "small" }, { "id": "F-23", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "severity": "high", "confidence": "high", "summary": "Served over HTTPS with a sensible Content-Security-Policy and secure, SameSite cookies; no mixed content or obvious transport/header smells.", "evidence": "HTTPS, HSTS and nosniff are present, but CSP allows unsafe-inline and unsafe-eval and the bm_sz cookie is not Secure with SameSite=None.", "artifacts": [ "evidence/home-headers.json", "evidence/home-cookies.json" ], "suggestedFix": "Move to nonce/hash-based CSP without unsafe-eval and mark all transport-sensitive cookies Secure with an appropriate SameSite value.", "effort": "large" }, { "id": "F-24", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "privacy", "severity": "high", "confidence": "high", "summary": "No over-collection of user data, no leaky third parties, and analytics/background data collection is minimised and batched rather than chatty or session-wide by default.", "evidence": "The consent wall names 1,017 partners; the HAR records 47 third-party requests transferring 4.11 MB and the tracker inventory finds 12 third-party origins.", "artifacts": [ "evidence/home-desktop.png", "evidence/home-summary.json", "evidence/home-trackers.json" ], "suggestedFix": "Reduce partner scope and prevent optional analytics/ad/auth vendors from loading until purpose-specific consent and need.", "effort": "large" }, { "id": "F-25", "pathId": "auth", "url": "https://www.fifa.com/en/auth", "principleId": "be-private-and-secure", "principleCheckId": "in-context-permissions-and-modern-auth", "guidanceId": "passkeys", "severity": "medium", "confidence": "medium", "summary": "Permission prompts are requested in context (not on load), and authentication uses modern, phishing-resistant methods (passkeys / WebAuthn) where relevant rather than passwords alone.", "evidence": "Notification/geolocation remain prompt rather than being requested on load, but the account/auth surface exposed no passkey or WebAuthn flow and the inspected /auth route produced an empty-title dead end.", "artifacts": [ "evidence/pwa-permissions-probe.json", "evidence/auth-probe.json", "evidence/auth.png" ], "suggestedFix": "Make account entry reliable and offer discoverable WebAuthn/passkey authentication rather than an opaque SDK/dead route.", "effort": "large" }, { "id": "F-26", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "severity": "medium", "confidence": "medium", "summary": "Browser-enforced defenses are configured where appropriate: HSTS, clickjacking protection (frame-ancestors / X-Frame-Options), Trusted Types for XSS-sensitive apps, origin isolation, privacy-preserving third-party cookie posture, and sensible Referrer-Policy / Permissions-Policy.", "evidence": "HSTS, SAMEORIGIN, no-referrer and nosniff are configured, but Permissions-Policy is missing and the CSP relies on unsafe-inline/unsafe-eval with an exceptionally broad allowlist.", "artifacts": [ "evidence/home-headers.json" ], "suggestedFix": "Add a least-privilege Permissions-Policy and tighten CSP source lists and script execution policy.", "effort": "medium" }, { "id": "F-27", "pathId": "article", "url": "https://www.fifa.com/en/articles/award-winners", "principleId": "be-resilient", "principleCheckId": "progressive-enhancement", "guidanceId": "html", "severity": "critical", "confidence": "high", "summary": "Core content and primary flows are reachable and usable without JavaScript and on older or non-Baseline browsers; modern features layer on as enhancements with fallbacks, and reactive/transition state stabilises rather than flickering before it settles.", "evidence": "Raw HTML for homepage, category and article is an empty #root shell: 0% rendered content coverage, no raw title/H1/description, and blank crawler screenshots without JavaScript.", "artifacts": [ "evidence/home-discoverability.json", "evidence/home-discoverability-crawler.png", "evidence/article-discoverability.json", "evidence/article-discoverability-crawler.png", "evidence/category-discoverability.json", "evidence/category-discoverability-crawler.png" ], "suggestedFix": "Server-render titles, headings, article/list content, and links so core content works without JavaScript; hydrate enhancements afterward.", "effort": "large" }, { "id": "F-28", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "be-resilient", "principleCheckId": "offline-and-installable", "guidanceId": "html", "severity": "low", "confidence": "low", "summary": "Where the site is an app, it is installable (web app manifest) and offers an offline fallback and works on flaky networks. (Contextual: a brochure or intrinsically-online site may reasonably not need this.)", "evidence": "A standalone web app manifest exists, but navigator.serviceWorker.getRegistrations() returned no registrations, so no offline fallback is active.", "artifacts": [ "evidence/pwa-permissions-probe.json" ], "suggestedFix": "Either register a scoped service worker with a useful offline fallback or remove app-installability signals that imply offline resilience.", "effort": "medium" }, { "id": "F-29", "pathId": "error", "url": "https://www.fifa.com/en/this-route-does-not-exist-atomic-audit", "principleId": "be-resilient", "principleCheckId": "network-and-http-failure-states", "guidanceId": "persistent-toast-notifications", "severity": "high", "confidence": "high", "summary": "HTTP errors, network failures, timeouts and stale data states are handled intentionally: users see useful recovery options rather than blank screens, infinite spinners, broken shells, or misleading success states.", "evidence": "The tested missing route returns a soft-404 HTTP 200 and offers no actionable recovery control, title, or link.", "artifacts": [ "evidence/not-found-probe.json", "evidence/not-found.png" ], "suggestedFix": "Return semantic error status and provide useful recovery navigation for failed routes and data loads.", "effort": "small" }, { "id": "F-30", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "deliver-optimized-decorative-images", "severity": "medium", "confidence": "medium", "summary": "Images and decorative assets are optimised and served at appropriate resolutions; decorative pseudo-element imagery and heavy decorative images are resolution-optimised rather than oversized.", "evidence": "The page transfers 437 KB of images and the image audit finds an oversized logo source (1178 px natural width for 74 px display) plus a legacy PNG.", "artifacts": [ "evidence/home-summary.json", "evidence/home-images.json" ], "suggestedFix": "Serve appropriately sized AVIF/WebP responsive sources and avoid downloading oversized logo/decorative assets.", "effort": "medium" }, { "id": "F-31", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "be-sustainable", "principleCheckId": "no-wasteful-work", "guidanceId": "efficient-background-processing", "severity": "high", "confidence": "high", "summary": "Background work and fetching are not wasteful: background processing is efficient and de-prioritised, and the lightest technique that achieves the result is preferred over heavy or redundant work.", "evidence": "The initial load fetches a PDF worker, a 1.77 MB auth SDK, consent/analytics integrations, and 35 scripts before those capabilities are requested, while trace/Lighthouse show substantial blocking work.", "artifacts": [ "evidence/home-summary.json", "evidence/home-trace-summary.json" ], "suggestedFix": "Conditionally import route-specific SDKs and deprioritize analytics/background processing.", "effort": "large" }, { "id": "F-32", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "deprioritize-background-fetches", "severity": "high", "confidence": "high", "summary": "Third-party scripts, fonts, video, audio, animation and heavy media are proportionate to the user value they provide; autoplay or background media is avoided unless essential and resource use is cached or deferred where possible.", "evidence": "Third parties account for 47 requests and 4.11 MB, about 69% of transferred bytes; PingOne and OneTrust alone transfer roughly 2.87 MB.", "artifacts": [ "evidence/home-summary.json", "evidence/home.har" ], "suggestedFix": "Adopt a third-party byte/request budget and lazy-load optional vendors after interaction or consent.", "effort": "large" }, { "id": "F-33", "pathId": "home", "url": "https://www.fifa.com/en", "principleId": "be-agent-ready", "principleCheckId": "structured-agent-capabilities", "guidanceId": "webmcp", "severity": "low", "confidence": "low", "summary": "Where it makes sense, the site exposes structured, safe capabilities to agents via WebMCP tools, agentic forms, and agentic JavaScript tools rather than leaving agents to scrape and guess.", "evidence": "This globally prominent content site exposes no WebMCP/agentic form capability, while non-JavaScript agents receive an empty shell with 0% content coverage.", "artifacts": [ "evidence/home-comprehensive-probe.json", "evidence/home-discoverability.json", "evidence/article-discoverability.json" ], "suggestedFix": "First make content server-readable, then expose safe structured search/content capabilities where WebMCP adds user value.", "effort": "large" }, { "id": "F-34", "pathId": "search", "url": "https://www.fifa.com/en?searchOverlay=1", "principleId": "be-memory-efficient", "principleCheckId": "bounded-footprint", "guidanceId": "manage-recurring-intervals", "severity": "medium", "confidence": "medium", "summary": "Heap size and DOM node count are reasonable for what the page is; the footprint is proportionate rather than bloated.", "evidence": "A single homepage/search state retains about 80.8 MB across 1.49 million heap nodes, a large footprint for a content/search page before extended use.", "artifacts": [ "evidence/heap-baseline.json" ], "suggestedFix": "Reduce always-loaded SDKs and DOM/object populations, then set and monitor a retained-heap budget per template.", "effort": "large" } ], "taskList": [ { "id": "T-1", "title": "Server-render core content and route metadata", "priority": 1, "findingIds": [ "F-20", "F-21", "F-22", "F-27" ], "guidanceId": "html", "status": "open" }, { "id": "T-2", "title": "Cut critical-path and third-party JavaScript", "priority": 2, "findingIds": [ "F-09", "F-11", "F-12", "F-13", "F-31", "F-32", "F-34" ], "guidanceId": "performance", "status": "open" }, { "id": "T-3", "title": "Remove stacked first-load interruptions", "priority": 3, "findingIds": [ "F-04", "F-05", "F-06", "F-07" ], "guidanceId": "declarative-dialog-popover-control", "status": "open" }, { "id": "T-4", "title": "Stabilise layout and reserve late content space", "priority": 4, "findingIds": [ "F-10" ], "guidanceId": "visually-stable-font-fallbacks", "status": "open" }, { "id": "T-5", "title": "Repair failure and recovery states", "priority": 5, "findingIds": [ "F-08", "F-29" ], "guidanceId": "persistent-toast-notifications", "status": "open" }, { "id": "T-6", "title": "Respect motion and theme preferences", "priority": 6, "findingIds": [ "F-01", "F-02" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T-7", "title": "Fix accessibility audit failures", "priority": 7, "findingIds": [ "F-14", "F-15", "F-16" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T-8", "title": "Tighten privacy and browser security policy", "priority": 8, "findingIds": [ "F-23", "F-24", "F-26" ], "guidanceId": "security", "status": "open" }, { "id": "T-9", "title": "Correct platform, image, and console hygiene", "priority": 9, "findingIds": [ "F-17", "F-18", "F-19", "F-30" ], "guidanceId": "html", "status": "open" }, { "id": "T-10", "title": "Make account entry reliable and modern", "priority": 10, "findingIds": [ "F-25" ], "guidanceId": "passkeys", "status": "open" }, { "id": "T-11", "title": "Use native gesture and optional agent capabilities", "priority": 11, "findingIds": [ "F-03", "F-28", "F-33" ], "guidanceId": "webmcp", "status": "open" } ], "budget": { "pathCount": 6, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-23T05-03-41-342Z" }